If you are a fan of Faiz_, ``Burst Mode`` or ``Single Mode`` shouldsound familiar and inspiring.

Burst Mode++++++++++

Watch and replay to obtain general understanding of the process.

Use ``-b / --burst`` to control the interval (in seconds).Note that ``-b0`` means ``Single Mode``, which is the default.

Single Mode+++++++++++

Play and examine various contentssuch as the stack, registers or memory addresses,carefully and step by step,to acquire comprehensive and detailed knowledge of the process.

Use ``Enter`` or ``Ctrl + D`` to step.

You can execute normal GDB_ commands via the promt.But note that BinTut won't synchronize the displaywhen you execute state-changing commands,e.g. ``stepi`` or ``nexti``,which are discouraged for the time being.

Another bad news is that readline_ does not work :scream:,and I can't figure out the reason :scream:.

Exercises---------

Write exploits that work outside debuggerswhen you understand the principles and techniquesvia watching and replaying (i.e. rewatching),careful **playing** (i.e., **Single Mode**),and most importantly,**reading the source code responsible for exploit generation**,which resides in a file named ``exploits.py``.

Installation============

Notice------

If pip_ is used to install BinTut,make sure that you use the pip_ versioncorresponding to the Python_ version shipped with GDB_.For more details, see `#1`_.

``pip install bintut`` may or may not work for the time being.

Therefore it's recommended to just clone this repositoryand run without installationas long as necessary libraries are installedby ``pip install -r requirements.txt``.

Warning-------

BinTut does not work inside virtualenv at present.

Tested Platforms----------------

`Arch GNU/Linux`_+++++++++++++++++

Current version of `Arch Linux`_ ships GDB_ with Python_ 3,in which I developed BinTut.

The latest release version should work fine.

- Enable ``multilib`` in ``/etc/pacman.conf``.

- Install ``gcc-mulitilib`` to support compiling and execution of 32-bit programs.

::

sudo pacman -S gcc-mulitilib

- Install Python_ 3 and ``pip3``.

::

sudo pacman -S python python-pip

- Install BinTut using ``pip3``

::

sudo pip3 install bintut

- You are ready!

::

bintut -b0.1 jmp-esp

`Fedora GNU/Linux`_+++++++++++++++++++

The latest Fedora Workstation comes with GDB_ with Python_ 3,which has been testedand BinTut is known to work properlyas in `Arch Linux`_.

This course is not demonstrative enoughand shall be updated when the author finds a scenariowhere `nop-slide`_ really stands out.

3. jmp-esp++++++++++

Return to shellcode via JMP ESP / RSP.

Linux x86 / x64.

NX: Disabled.

ASLR: Disabled.

Stack Protector: Disabled.

4. off-by-one NULL++++++++++++++++++

Variant of ``plain`` `stack-based buffer overflow`_.

Linux x86 / x64.

NX: Disabled.

ASLR: Disabled.

Stack Protector: Disabled.

5. ret2lib_+++++++++++

Return to functions.

Linux x86.

NX: **Enabled**.

ASLR: Disabled.

Stack Protector: Disabled.

.. _`Notes for x64`:

Notes for x64*************

Either on Linux or Windows, the `ABI of x64`_, unlike that of x86,passes some arguments, first six or four integral argumentson Linux or Windows respectively,via registers, which may not be controlledwithout resort to certain gadgets.

Therefore, it may be discussed in the section for ROP_.

6. frame-faking+++++++++++++++

Return to chained functions via LEAVE RET gadget.

Linux x86.

NX: **Enabled**.

ASLR: Disabled.

Stack Protector: Disabled.

Notes for x64*************

See `Notes for x64`_.

Bug Reports===========

Create `issues <https://github.com/NoviceLive/bintut/issues>`_.

BinTut might or might not work on your system,but bug reports with necessary information are always welcome.

Tips----

Remember to include ``bintut --version`` in your report.

You can just submit the verbose log (``stderr``) if out of words,e.g., ``bintut -v -b0.1 frame-faking 2>log.txt``.

TODO List & You Can Contribute==============================

- Improve the code if you find something that can be done better.

The codebase of BinTut can always be improved by those who have a deeper understanding of Python than the author.

Also, there are hardcoded behaviors which can be generalized.

- Change color scheme to red highlight when content changes.

Currently, our color scheme remains unchanged, in predefined colors, which is just not eye-catching or obvious when we want to observe some significant changes in certain registers or specific memory locations.

Here is an example of such change, the least-significant-**byte** of saved EBP / RBP being cleared due to an off-by-one NULL write.

Ref. That's what you will expect in OllyDbg and probably many other debuggers will also behave in this manner.

Ref. Some GDB_ enhancement projects have already implemented this.

- Synchronize the display when executing state-changing commands.

- Add course variants that does not allow NULL bytes.

For example, add variant courses using ``strcpy`` instead of ``fread`` to trigger overflow, in order to demonstrate the techniques to survive in severe environments, which happen to be the case of our real world.